• debian/ was read in full: control, rules, copyright, changelog (head and tail), source/format, source/options, the four patches and series, rachis.docs, rachis.README.Debian, README.test, lintian-overrides, tests/control, tests/run-unit-test, upstream/metadata, upstream/edam, salsa-ci.yml, TODO.
• Licensing inventory: all 153 .py files under src/ carry the identical 3-clause BSD header naming 'QIIME 2 development team' (one, plugin/model/tests/test_directory_format.py, says 2022-2026); the upstream LICENSE and conda-recipe/meta.yaml both say BSD-3-Clause. No other holder or licence was found anywhere in the tree.
• The prescan's one unmatched holder, 'QIIME 2 development team', is covered by the Files: * Copyright line '2016-2026 QIIME 2 and Rachis development team', which is also the wording of LICENSE.
• src/rachis/core/testing/util.py:93 ReallyEqualMixin says only 'Based on this public domain code' (ludios.org), so it adds no licence obligation.
• src/rachis/core/archive/provenance_lib/assets/copyright_note.txt is the notice written into generated archives about the copyright of the user's own data; it is not a licence of the package.
• Archive src/rachis/core/archive/provenance_lib/tests/data/cite_one.zip contains cite_one.bib; cite_many.zip and cite_none.zip are the same fixture for the .bib files of those names shipped beside them in the same directory (cite_none.bib is empty). All are inputs of test_archive_parser.py:323-325, not build products.
• src/rachis/core/archive/provenance_lib/tests/data/rarefied_table.qza is a fixed input fixture of test_replay.py:103 (a QIIME 2 artifact, i.e. a zip of VERSION/metadata.yaml/data). The reader would not unpack it (unrecognised extension, non-UTF-8); it is judged from its use in the test and from its sibling fixtures, which are expanded copies of the same structure (concated-ints-v*//{VERSION,metadata.yaml,provenance/action/action.yaml,data/ints.txt}, plain provenance data with no licence-bearing content).
• src/rachis/citations.bib, dupes.bib and the cite_.bib files hold bibliographic records only; the metadata//tests/data/*.tsv files are small test tables.
• Source was searched for non-free wording (non-commercial, no-modification, field-of-use), for SPDX tags, GPL/LGPL/Apache/MPL/CC notices, and for embedded third-party code or JS: no hits outside the BSD headers listed above.
• Dependency check against imports: every third-party module imported (yaml, pandas, numpy, networkx, bibtexparser, parsl, psutil, flufl.lock, tomlkit, tzlocal, platformdirs, lxml, dateutil, dill, setuptools) is in Depends or is added to ${python3:Depends} by dh_python3 from the installed dist-info Requires-Dist (man dh_python3, NOTES/dependencies: version information is discarded by default); numpy is the one not written out by hand and is translated. The changelog's removal of python3-decorator, python3-pyparsing, python3-notebook and python3-tornado is consistent with the tree, which no longer imports them.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components equal); debhelper compat 14; dh-sequence-single-binary is provided by debhelper 14.5 itself, so the Build-Depends entry is satisfiable.
• Patches carry DEP-3 headers with Description, Author, Forwarded and Last-Update, and each applies against the tree as unpacked (the .pc copies match).
• debian/tests/run-unit-test sets RACHISTEST (empty counts as set, rachis/core/util.py:53) and copies the installed package to run pytest; tests/control declares python3-pytest and skippable, and the 32-bit skip uses exit 77 accordingly.
• Not checked by building: no build or test run was possible, so the compile/test behaviour and the generated ${python3:Depends} were reasoned from the package and the reference tools only.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2026.10.1, packaged 2026.10.0), which is not a fault of the package.

None.

None.